Splunk Search

Is there a way to do retention based on sourcetypes?

prabhu77749
Explorer

Hi rteam,

We have too many index created and now planning to have different retention duration  based on sourcetypes. Cant  go with one  index for each sourcetype, which will   impact operations and many teams who are searching fir data . 

Is there any way to do retention based on sourcetype level. Thanks in advance 

Tags (2)
0 Karma
1 Solution

Nisha18789
Builder

Hello @prabhu77749 , unfortunately retention can only be applied on indexes.

So, its better to create different indexes for those sourcetypes and define the retention policies on them.

However, in order to support smooth operations you can create macros for grouping indexes like :

parent-index : (index=indexA1 OR index=indexA2 OR index=indexA3)

so that they can be used as `parent-index` in the queries.

Hope this helps!

View solution in original post

0 Karma

Nisha18789
Builder

Hello @prabhu77749 , unfortunately retention can only be applied on indexes.

So, its better to create different indexes for those sourcetypes and define the retention policies on them.

However, in order to support smooth operations you can create macros for grouping indexes like :

parent-index : (index=indexA1 OR index=indexA2 OR index=indexA3)

so that they can be used as `parent-index` in the queries.

Hope this helps!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...